Data storage combining row-oriented and column-oriented tables

Abstract

A data storage system includes a query manager to identify storage engines to execute a query. A first storage engine may execute a portion of the query on a row-oriented table and a second storage engine may execute a second portion of the query on a column-oriented table.

What is claimed is: 
     
         1 . A data storage system comprising:
 a query manager executed by at least one processor to receive a query, and to identify storage engines to execute the query; and   storage engines, wherein a first of the storage engines executes a portion of the query on a row-oriented table and a second of the storage engines executes a second portion of the query on a column-oriented table, and the row- oriented table and the column-oriented table are for the same database.   
     
     
         2 . The data storage system of  claim 1 , wherein the query manager is to receive results of the portion of the query executed on the row-oriented table and the second portion of the query executed on the column-oriented table and is to perform operations on the results to determine results for the query. 
     
     
         3 . The data storage system of  claim 2 , wherein the operations performed on the results to determine the results for the query comprise a join or a sort. 
     
     
         4 . The data storage system of  claim 1 , wherein the query manager is to store meta data describing the data stored in each table, whether each table is column-oriented or row-oriented, and the storage engine associated with each table, and the query manager is to use the meta data to identify the first and second storage engines from a set of storage engines. 
     
     
         5 . The data storage system of  claim 1 , wherein the database is to store security event information for a network. 
     
     
         6 . The data storage system of  claim 5 , wherein the security event information comprises event data and the data storage system is to receive the event data from a security information and event management system receiving the event data from a plurality of sources. 
     
     
         7 . A non-transitory computer readable medium storing machine readable instructions that are executable by at least one processor to:
 receive a query;   parse the query into sub queries;   identify storage engines from a plurality storage engines to execute the sub queries based on tables associated with the storage engines and information requested in the sub queries; and   send the sub queries to the storage engines, wherein a first of the storage engines executes a first of the sub queries on a row-oriented table and a second of the storage engines executes a second of the sub queries on a column-oriented table, and the row-oriented table and the column-oriented table are for the same database.   
     
     
         8 . The non-transitory computer readable medium of  claim 7 , wherein the machine readable instructions are executable by the at least one processor to:
 receive results of the sub queries from the storage engines; and   perform operations on the results to generate query results for the received query.   
     
     
         9 . The non-transitory computer readable medium of  claim 8 , wherein the operations performed on the results comprise a join or a sort. 
     
     
         10 . The non-transitory computer readable medium of  claim 7 , wherein the machine readable instructions are executable by the at least one processor to:
 store meta data describing the data stored in each table, whether each table is column-oriented or row-oriented, and the storage engine associated with each table.   
     
     
         11 . The non-transitory computer readable medium of  claim 10 , wherein the machine readable instructions are executable by the at least one processor to:
 identify the first and second storage engines from a set of storage engines according to information in the meta data.   
     
     
         12 . A method of performing a query in a data storage system, the method comprising:
 receiving a query;   parsing the query into sub queries;   identifying, by at least one processor, storage engines from a plurality storage engines to execute the sub queries based on tables associated with the storage engines and information requested in the sub queries;   sending the sub queries to the storage engines, wherein a first of the storage engines executes a first of the sub queries on a row-oriented table and a second of the storage engines executes a second of the sub queries on a column- oriented table, and the row-oriented table and the column-oriented table are for the same database;   receiving results of the sub queries from the storage engines; and   performing operations on the results to generate query results for the received query.   
     
     
         13 . The method of  claim 12 , comprising:
 storing meta data describing the data stored in each table, whether each table is column-oriented or row-oriented, and the storage engine associated with each table.   
     
     
         14 . The method of  claim 13 , comprising:
 identifying the first and second storage engines from a set of storage engines according to information in the meta data.   
     
     
         15 . The method of  claim 12 , wherein the operations performed on the results comprise a join or a sort.